Crypto Hacker Launders $19M ETH Through Tornado Cash

A hacker who compromised a multisignature wallet has laundered more than $19 million worth of ETH through Tornado Cash since December. Blockchain security firm PeckShield identified the ongoing laundering activity following the initial exploit.

The incident demonstrates the continued use of privacy tools to obscure the movement of stolen cryptocurrency. The funds remain untraceable as they pass through the mixing protocol.

The security breach originated from a compromised multisignature wallet. These wallets require multiple private keys to authorize transactions, theoretically providing a higher security standard than standard wallets.

Despite these safeguards, the attacker managed to gain control and initiate unauthorized transfers. The compromise allowed the hacker to access and drain the wallet's assets.

Key details regarding the breach include:

• The target was a multisignature wallet infrastructure
• The attacker successfully bypassed security protocols
• Initial theft occurred prior to the laundering phase

Following the theft, the hacker utilized Tornado Cash to obscure the origin of the funds. This decentralized protocol mixes cryptocurrencies from various sources to break the traceable link on the blockchain.

PeckShield tracked the movement, noting that the hacker has laundered over $19 million in ETH. The process began in December and has continued steadily.

The use of such mixing services makes it exceptionally difficult for authorities and blockchain analysts to freeze or recover the stolen assets.

The laundering activity has been a prolonged effort rather than a single transaction. By spreading the movement of funds over several weeks, the attacker reduces the risk of immediate detection or blacklisting by exchanges.

According to the report, the total amount laundered stands at more than $19 million. This figure represents a significant portion of the stolen assets, suggesting a calculated approach to cashing out.

This event serves as a reminder of the risks associated with holding assets in smart contract wallets. While multisig wallets are designed to prevent unilateral control, they remain targets for sophisticated attackers.

The incident raises questions about the effectiveness of current security measures in the decentralized finance (DeFi) sector. It also highlights the ongoing debate surrounding privacy tools like Tornado Cash, which serve both legitimate privacy needs and illicit money laundering.